HOT Omni Bridge on NEAR Exploited: $3.86 Million in BSC Treasury Payouts Later Returned, CertiKAlert Reports
Key Takeaways
- •CertiK's CertiKAlert monitoring service identified HOT Omni Bridge on NEAR as the exploited protocol, recording five payouts routed through BNB Smart Chain treasury addresses on September 30.
- •The aggregate value of the observed BSC-side outflows reached $3.86 million, although CertiKAlert reported that the funds were later returned.
- •The public alert did not disclose how the funds were returned, the exploit's mechanics, or the attacker's identity, and contained no transaction hashes or wallet addresses.
- •The five-payout pattern indicates multiple discrete withdrawals rather than a single atomic drain, a structure that can suggest probing behavior or a rate-limited contract flaw.
- •Neither the HOT Protocol team nor the NEAR Foundation has issued an official disclosure, leaving the root cause and the bridge's current security status unconfirmed.
HOT Omni Bridge, a cross-chain bridge operating on the NEAR Protocol, was exploited on September 30, resulting in five payouts from BSC treasury addresses that totaled $3.86 million, according to a CertiKAlert report published on October 9. The on-chain security monitoring arm of blockchain auditor CertiK noted that the exploited funds were subsequently returned, although the mechanics of the attack and the identity of the exploiter remain unconfirmed in the public alert.
What the CertiKAlert Report Confirms
CertiKAlert flagged the incident under its #CertiKInsight classification, identifying HOT Omni Bridge as the exploited protocol. The five payouts were routed through BNB Smart Chain (BSC) treasury addresses, a routing pattern that suggests the attack vector involved the bridge's cross-chain messaging or liquidity layer between NEAR and BSC.
The $3.86 million figure represents the aggregate of the five observed BSC-side outflows. CertiKAlert stated that the amount was later returned, a detail that distinguishes the incident from a typical irreversible bridge drain but does not resolve whether the return was voluntary, coerced, or the result of on-chain recovery mechanisms. The public alert did not specify when or how the funds were returned, and it included no transaction hashes or wallet addresses.
On 30 Sept, HOT Omni Bridge on NEAR was exploited resulting in five observed BSC treasury payouts totaling $3.86M, which was later returned.
Read our full analysis here👇
CertiK Report Security Dashboard 👇
Source: @CertiKAlert on X
Risk Implications for NEAR Bridge Users
Bridge exploits carry outsized systemic risk in multi-chain DeFi because bridges sit at the trust boundary between two separate execution environments, locking assets on one network while releasing or minting corresponding assets on another. NEAR runs its own smart contract runtime rather than the Ethereum Virtual Machine, so bridges linking it to EVM chains such as BSC must verify messages across differing execution and cryptographic standards. When a bridge's treasury is accessed without authorization, all assets locked on either side of the bridge face potential exposure until the vulnerability is patched and independently verified.
The five-payout structure observed in this incident suggests the attacker made multiple discrete withdrawals rather than a single atomic drain, a pattern that can indicate probing behavior or a rate-limited smart contract flaw.
NEAR's broader ecosystem has been expanding its cross-chain surface area, recently adding post-quantum asset infrastructure across multiple chains with the launch of Quantus (QTC). Each additional bridge or cross-chain primitive increases the attack surface that security monitoring services such as CertiK must cover. No statement from the HOT Protocol team or the NEAR Foundation was referenced in the alert, so users who held assets on HOT Omni Bridge around September 30 should verify their current balance state and monitor for an official incident disclosure from those teams.
The return of funds does not confirm that the bridge's smart contracts are secure. In several historical bridge incidents, funds were returned after whitehat interventions or negotiated disclosure while the underlying vulnerability remained unpatched for days. Poly Network's August 2021 exploit, in which roughly $611 million was drained and the majority of the funds were subsequently returned, remains a frequently cited precedent for a negotiated outcome. Until a formal post-mortem is published by the bridge team or CertiK's full analysis is released, the exploit's root cause, the affected contract addresses, and the bridge's current security status all remain open questions.
What to Track as Verified Details Emerge
The CertiKAlert post links to a full CertiK analysis report, as well as CertiK's Security Dashboard. Readers should monitor the report for the specific vulnerability class, such as a signature verification bypass, reentrancy, or oracle manipulation, along with the confirmed transaction hashes on both the NE and BSC sides and whether the bridge has been paused or patched. An official statement from the HOT Protocol team disclosing whether the return was negotiated or forced by on-chain governance would materially change the risk assessment.
Key unresolved questions include whether HOT Omni Bridge remains operational, whether any user funds beyond the treasury payouts were at risk, and whether the five BSC treasury addresses involved have been publicly identified. Cross-chain bridge security remains an ongoing concern across the DeFi stack, as illustrated by comparable incidents involving bridges that connect EVM and non-EVM chains, including Wormhole's February 2022 exploit on the Solana–Ethereum route and the March 2022 Ronin Bridge breach, with losses of roughly $325 million and $624 million, respectively. BSC-side bridge infrastructure has been targeted before as well: in October 2022, a proof verification flaw in the BNB Bridge enabled the unauthorized minting of roughly $570 million in BNB and prompted a temporary halt of BNB Chain. Parallel industry efforts, such as the development of Chainlink CCIP vault adapters for one-click cross-chain deposits, reflect a broader push to standardize and harden bridge-layer security.
